How to Check the Blue Screen Log in Windows 11 (BSOD Crash Details)

by

When Windows 11 crashes with a blue screen (BSOD), it restarts so quickly that you rarely get time to read the stop code. Fortunately, Windows records every crash. You can find the details in Reliability Monitor, Event Viewer, and the minidump files Windows saves, then use the stop code and the faulting driver to track down the cause. This guide shows each method, from the easiest to the most detailed.

Quick Answer

Press Windows + R, type perfmon /rel, and press Enter to open Reliability Monitor. Click a day with a red X, find Windows – Shut down unexpectedly, and click View technical details to see the BugCheck code and dump file location. For more detail, check Event Viewer for Event ID 1001 or open the dump in WinDbg.

Reliability Monitor chart with a red critical event on one day selected and the Windows shut down unexpectedly entry highlighted in the details list
(1) Select a day with a red X; (2) open the critical event's technical details to see the crash code.

Method 1: Reliability Monitor (Easiest)

  1. Press Windows + R, type perfmon /rel, and press Enter. (Or search Start for View reliability history.)
  2. Look for red X icons in the Critical events row of the chart. Click that day.
  3. In the list below, find Windows with the summary Shut down unexpectedly.
  4. Double-click it or click View technical details. Note the BugCheck Code (for example, 0x0000000a), the parameters, and the dump file path.

Method 2: Event Viewer

  1. Right-click Start and choose Event Viewer.
  2. Go to Windows Logs > System.
  3. In the right pane, click Filter Current Log.
  4. In the <All Event IDs> box, type 1001, 41 and click OK.
  5. Look at the results:
    • Event ID 1001 (source: BugCheck): “The computer has rebooted from a bugcheck.” It lists the stop code and dump file.
    • Event ID 41 (Kernel-Power): the system rebooted without shutting down cleanly. On its own it can also mean a power loss or forced shutdown.

Right-click the filtered log and choose Save Filtered Log File As if you want to share it with a technician. See our guide to checking the Windows event log for more tips.

Method 3: Find and Read Minidump Files

Windows saves crash data in dump files:

  • Small dumps: C:\Windows\Minidump (one file per crash, named by date)
  • Full or kernel dump: C:\Windows\MEMORY.DMP

Analyze a dump with WinDbg

  1. Install WinDbg from the Microsoft Store (free).
  2. Open WinDbg as administrator, choose File > Open dump file, and browse to a file in C:\Windows\Minidump. (Copy it to your Desktop first if access is denied.)
  3. When it loads, click the !analyze -v link or type it in the command box and press Enter.
  4. Look for BUGCHECK_CODE, MODULE_NAME, IMAGE_NAME, and PROCESS_NAME. A third-party driver file (for example, a graphics, network, or antivirus .sys file) is often the culprit.

Free third-party viewers can also list minidumps in a simple table, but WinDbg gives the most accurate analysis.

Make Sure Windows Saves Crash Dumps

  1. Press Windows + R, type sysdm.cpl, and press Enter.
  2. Open the Advanced tab and click Settings under Startup and Recovery.
  3. Under Write debugging information, choose Small memory dump (256 KB) or Automatic memory dump.
  4. To see the blue screen before it restarts, uncheck Automatically restart. See disabling automatic restart in Windows 11.
  5. Keep the page file enabled on the system drive; Windows needs it to write dumps.

Common Stop Codes and What They Suggest

Stop code Common causes
IRQL_NOT_LESS_OR_EQUAL (0xA) Faulty or outdated driver, RAM problems
PAGE_FAULT_IN_NONPAGED_AREA (0x50) RAM, driver, or antivirus issues
SYSTEM_SERVICE_EXCEPTION (0x3B) Driver or system file problems
DPC_WATCHDOG_VIOLATION (0x133) Storage driver or SSD firmware
CRITICAL_PROCESS_DIED (0xEF) Corrupted system files, failing drive
WHEA_UNCORRECTABLE_ERROR (0x124) Hardware: CPU, overclocking, overheating, power
VIDEO_TDR_FAILURE (0x116) Graphics driver or GPU

What to Do After You Find the Cause

  • Update or roll back the driver named in the dump (Device Manager, or the hardware maker’s site).
  • Install Windows updates in Settings > Windows Update.
  • Repair system files: run DISM /Online /Cleanup-Image /RestoreHealth and then sfc /scannow in an admin terminal.
  • Test your RAM with Windows Memory Diagnostic (search for it in Start).
  • Check the drive with chkdsk C: /scan and your SSD maker’s tool.
  • Undo overclocks and check temperatures if you see hardware stop codes.

Related: Fix the SYSTEM_SERVICE_EXCEPTION error in Windows 11.

Frequently Asked Questions

Why is the Minidump folder empty?

Dumps may be disabled, the page file may be off or too small, or a cleanup tool deleted them. Check Startup and Recovery settings.

Is Event ID 41 always a blue screen?

No. It means Windows didn’t shut down cleanly, which can also happen from a power cut or holding the power button. Look for a matching Event ID 1001 to confirm a BSOD.

Can I delete old dump files?

Yes, once you’ve finished troubleshooting. Disk Cleanup’s System error memory dump files option removes them.

Summary

  1. Open perfmon /rel and check critical events for the BugCheck code.
  2. In Event Viewer, filter the System log for Event IDs 1001 and 41.
  3. Open minidumps from C:\Windows\Minidump in WinDbg and run !analyze -v.
  4. Fix the driver, system files, or hardware the logs point to.

Related posts: